[GNAP] GNAP core protocol - working group last call

[Mike Varley <[e-mail]>]

(re-sent)

Thank-you Yaron!

I have reviewed the latest draft, and am very impressed with the level of detail, context, use case descriptions and supporting guidance.
I wish I had more to add in terms of edits, but my only note was in the early sections (and very minor):

Section 1.2
- refer to section 1.4 "Trust relationships" in Note on "End user", e.g. “Note: that natural person may or may not be the same entity as the RO. See section 1.4 on Trust Relationship for more detail.”

I’m not sure I was the most meticulous of reviewers, having followed the spec from its early drafts and having worked with a few implementations I’ve likely overlooked some gaps in the spec (like references or clarifying statements); but as I’ve said I find the spec to be quite comprehensive and well written. It is specific where it needs to be and provides clear extension points for other emerging standards like DIDs and mobile scenarios.

A big thank-you to Fabian, Justin, and Aaron for putting this work together, and to all others who have been following and contributing. GNAP provides a clean model for securing some tricky authorization patterns in OAuth – and to have this work publicly specified and reviewed will make its adoption in the industry much easier.

Thanks again for everyone’s hard work,

MV